Stories first seen on 22 August 2026
Review the tracked stories and available summary evidence for the archived period shown.
Population: stories the tracker first saw on this Coordinated Universal Time (UTC) calendar day; publisher date is used only if first-tracked time is unavailable and remains on each item.
17 stories
- Government and Policy
Postal Service moves to finalize mail ballot regs before SCOTUS ruling
The U.S. Postal Service finalized new regulations on Friday that would grant the federal government authority to define mail-in voting eligibility standards, a power traditionally held by states and Congress under the Constitution. Multiple lower courts have already struck down these rules, but USPS said it will not implement them until the Supreme Court rules on the administration's appeal. The agency received 200,000 public comments and claims implementation is necessary to meet the November 3, 2026 midterm election deadline.
Why it matters: Election administrators and voting rights advocates must monitor the Supreme Court ruling and prepare for potential conflicting federal and state election rules for the 2026 midterm cycle, as implementation could disrupt established state-led ballot processes.
- AI Security
Frontier AI labs still won’t say how they’d contain a rogue model
A recent study reveals that leading artificial intelligence (AI) labs lack publicly documented plans for containing rogue models. The research highlights gaps in preparedness as AI systems increasingly exhibit unexpected and potentially dangerous behavior.
Why it matters: Security and AI leaders need to understand that major labs cannot articulate containment strategies, creating institutional risk if advanced models exhibit harmful behavior.
- Breaches and Incidents
Connecticut says data from 41,000 Medicaid members exposed in portal breach; the second portal incident this year
Connecticut's Medicaid provider portal, operated by Gainwell Technologies, suffered a breach on June 25, 2026, exposing payment and claims data for approximately 41,000 HUSKY Health members. This marks the second portal incident affecting the state's Medicaid program this year.
Why it matters: Medicaid beneficiaries and healthcare providers in Connecticut face exposure of sensitive payment and medical claims information; state agencies and Gainwell must accelerate incident investigation, notification, and remediation to prevent downstream fraud or identity theft.
- Regulatory and Compliance
TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit
TikTok agreed to pay $400 million to settle a U.S. Department of Justice lawsuit alleging violations of child privacy laws. The payment includes $300 million upfront and an additional $100 million contingent on vacating a prior consent decree.
Why it matters: Any organization handling children's data must monitor TikTok's compliance obligations and understand the regulatory precedent: child privacy violations carry substantial penalties, and platforms will face enforcement action for non-compliance.
- Threat Intelligence
Named Pipes Under Attack: Securing Windows Interprocess Communication
Windows named pipes enable fast interprocess communication but can expose privileged services when access controls are insufficient. ThreatLocker details defensive measures including endpoint verification, command authorization, input validation, and privilege scoping to harden named-pipe security.
Why it matters: Windows administrators and developers need to evaluate named-pipe configurations in their environment to prevent local privilege escalation and lateral movement attacks.
- Vulnerabilities and Patches
Your Expired Visa Card Could Be ‘Zombified’ to Make Contactless Payments
Research reveals that expired Visa cards can be repurposed for contactless payments through a technique called 'zombification,' allowing attackers to exploit payment systems after cards are no longer valid. The findings highlight a gap in Visa's contactless payment security model that could enable fraud without cardholder authorization.
Why it matters: Payment processors, card issuers, and merchants need to assess the risk of unauthorized contactless transactions on expired cards and implement stronger validation checks to prevent fraud.
- Threat Intelligence
Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight
Three banking trojans are receiving attention from security researchers: Manic, a spyware-equipped variant; Grandoreiro, which maintains active campaigns in Latin America and Europe; and ToxicPanda 2.0, an expanded version of existing malware. The article highlights current threat activity from banking malware families targeting financial institutions and users across multiple regions.
Why it matters: Financial institutions and their customers in Latin America and Europe face direct risk from these active banking trojans, which can steal credentials and intercept transactions; practitioners should review detection signatures and endpoint controls for Manic, Grandoreiro, and ToxicPanda 2.0.
- Threat Intelligence
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
Threat actors increasingly target CI/CD pipelines and developer tools rather than application code directly, exposing gaps in supply chain security. Organizations need comprehensive visibility across the entire software development lifecycle (SDLC) and enforce stringent security controls to defend against these attacks.
Why it matters: Development teams and security leaders must audit CI/CD infrastructure and developer tooling for misconfigurations and access weaknesses, as compromises here can inject malicious code at scale before applications reach production.
- Government and Policy
Lawmakers call for investigation into impact of CISA staffing cuts
Lawmakers have called for an investigation into the effects of staffing reductions at the Cybersecurity and Infrastructure Security Agency (CISA). The inquiry aims to determine what operational impacts the cuts have had and whether lost expertise has been adequately replaced.
Why it matters: Security practitioners rely on CISA for threat intelligence, advisories, and incident response guidance; staffing erosion may degrade the government's ability to support private sector defenders and critical infrastructure operators.
- Threat Intelligence
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
Researchers identified 14 trojanized npm packages posing as legitimate calendar and streak utilities that deploy RedC2 4.0, an artificial intelligence (AI)-powered Linux backdoor. The packages execute a bundled binary as a detached background process upon module load to establish persistent access.
Why it matters: Developers using these npm packages face immediate compromise of Linux systems with an AI-assisted command and control (C2) backdoor; verify your dependencies immediately against the malicious package list.
- Regulatory and Compliance
ReliaQuest GreyMatter Is on the FedRAMP® Marketplace
ReliaQuest's GreyMatter platform has achieved FedRAMP In Process status and is now listed on the FedRAMP Marketplace, with the company pursuing FedRAMP Moderate Authorization for federal agencies. GreyMatter automates security detection, investigation, and response across cloud, on-premises, and legacy systems, claiming 90% time savings and threat containment in under five minutes. The platform integrates Zero Trust principles and compliance reporting to support federal security teams in meeting regulatory mandates.
Why it matters: Federal agencies and contractors evaluating security automation and compliance tools can now assess GreyMatter as a path to modernize detection and response while maintaining FedRAMP alignment.
- Threat Intelligence
Scattered Spider Targets Tech Companies for Help-Desk Exploitation
Scattered Spider, a financially motivated cybercriminal gang, exploits help-desk systems and social engineering to target technology vendors, managed service providers, and high-value employees in retail, finance, and technology sectors. The group registers domains impersonating legitimate platforms, uses phishing kits like Evilginx to bypass multifactor authentication, and partners with ransomware operators to gain widespread access through compromised IT contractors. Recent attacks on UK and US retailers suggest the group is expanding its focus on supply chain compromises, leveraging trusted IT providers as gateways to infiltrate multiple client organizations.
Why it matters: Technology vendors, managed service providers, finance and retail organizations, and help-desk teams face credential theft and ransomware deployment through highly convincing social engineering and phishing campaigns; defenders should implement risk-based authentication, conduct social engineering assessments, enforce hardened jumpboxes with mandatory multifactor authentication, and monitor for typosquatted domains and Evilginx phishing infrastructure.
- Threat Intelligence
Threat Spotlight: Capitol x Kremlin: Will US Politics Reshape Russian Cyber Threats?
US policy shifts under the Trump administration, including tariff changes, CISA restructuring, and diplomatic efforts with Russia, are reshaping the ransomware and nation-state threat landscape. Ransomware targeting of US entities has declined following peace talks, but new groups like DragonForce are expanding activity and adopting cartel models to consolidate power in the criminal ecosystem. Budget cuts to CISA, supply-chain vulnerabilities from tariff-driven vendor transitions, and potential insider threats represent emerging risks for organizations globally.
Why it matters: US-based organizations face increased insider threat risk and supply-chain attacks as security budgets shrink and vendors undergo rapid transitions; European and Canadian organizations should prepare for potential ransomware shifts; all organizations need to monitor DragonForce and similar groups adopting cartel models that enable more sophisticated, coordinated attacks.
- Threat Intelligence
Threat Landscape Report: Uncovering Critical Cyber Threats to Hospitality and Recreation
A report covering September 1, 2024, to February 28, 2025, highlights a 433% increase in attacks on external remote services like virtual private networks (VPNs) and Remote Desktop Protocol (RDP) in the hospitality and recreation sector, alongside a 43% rise in ransomware incidents. Credential harvesting via phishing and impersonation campaigns also surged, with nearly half of phishing emails containing fake login pages, while groups such as Medusa and Akira targeted casinos and intellectual property. Cryptocurrency adoption in gambling and insider threats tied to artificial intelligence (AI) adoption further elevated risks.
Why it matters: Hospitality, recreation, and gambling organizations face elevated exposure to credential theft, ransomware, and IoT-based attacks, requiring immediate review of remote access, phishing defenses, and network segmentation.
- Threat Intelligence
Introducing: Finance & Insurance Sector Threat Landscape
ReliaQuest released a threat landscape report on attacks targeting the finance and insurance sector, identifying command shell execution and account discovery as the top techniques used by threat actors. The report benchmarks incident response performance, showing that organizations using automated response achieve 4-minute mean time to contain versus 4 hours with manual processes, and flags cryptojacking, hacktivism, and state-sponsored APT activity as emerging threats against the sector.
Why it matters: Finance and insurance practitioners should review this sector-specific threat analysis to understand attack patterns, validate their incident response automation, and assess exposure to cryptojacking and APT persistence tactics targeting their industry.
- Threat IntelligenceCVE-2023-28771CVE-2023-42793
Russia-Linked Threats to Operational Technology
A ReliaQuest report examines Russia-linked advanced persistent threat (APT) groups targeting operational technology (OT) environments, analyzing key cyber attacks from the past 12 months including coordinated energy sector attacks in Denmark, compromise of Ukraine's Kyivstar telecommunications provider, and exploitation of JetBrains TeamCity vulnerabilities. The analysis documents Russia-developed OT-specific malware such as COSMICENERGY and Industroyer variants, outlines tactics and techniques observed in a manufacturing sector incident, and forecasts continued targeting of Ukrainian and allied critical infrastructure alongside long-term espionage operations. The report provides detection rules and mitigation recommendations including network segmentation, multifactor authentication, account creation restrictions, and service execution controls.
Why it matters: Organizations operating OT in critical infrastructure, manufacturing, energy, and telecommunications must assess exposure to Russia-linked APT groups and ransomware groups that may act on state direction; implement the technical mitigations detailed to limit lateral movement, privilege escalation, and persistence.
- Threat Intelligence
Health Care Social Engineering Campaign
In early April 2024, ReliaQuest identified a social engineering campaign targeting health care organizations that used help desk interactions to bypass multifactor authentication (MFA) and gain access to accounts in revenue cycle management departments. The attackers supplied personal data to help desk staff to reset MFA, then accessed email and SharePoint to locate banking information and alter routing details.
Why it matters: Health care help desk and finance teams should review verification procedures for MFA resets to prevent credential theft and fraudulent banking changes.